Six modules name no /var/lib: the root is a place, the maps reference it

The state directories say place "." — the assignment's own root — and
every bind, secret, own-secret, receives and grants path references it
as ${dir:state}/…; grants directories that are their own resources are
placed by id. gitea's two coincidence strings from the first pass
(${dir:data}base.json — resolving correctly by pure concatenation) are
spelled honestly now. What still says /var/lib is inside containers —
the software's contract — or under /var/lib/mesh, the mesh's own
plumbing, which the requirements unification absorbs next. Every
resolved path is byte-identical to what runs; landing this is a no-op
on the node, and the converter checks its own boundaries this time.

modules/mongodb/module.json

@@ -32,13 +32,13 @@
     }
   },
   "receives": {
-    "mongodb-database": "/var/lib/mongodb/grants/mesh.json"
+    "mongodb-database": "${dir:grants}/mesh.json"
   },
   "grants": {
-    "mongodb-database": "/var/lib/mongodb/grants"
+    "mongodb-database": "${dir:grants}"
   },
   "own-secrets": {
-    "root": "/var/lib/mongodb/root.secret",
+    "root": "${dir:state}/root.secret",
     "broker": "/var/lib/mesh/mongodb/broker"
   },
   "secrets-owner": "999:999",
@@ -52,13 +52,12 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/mongodb",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/mongodb/grants",
       "mode": "0700"
     },
     {
@@ -86,7 +85,7 @@
       ],
       "volumes": [
         "${dir:data}:/data/db",
-        "/var/lib/mongodb/root.secret:/run/secrets/root:ro"
+        "${dir:state}/root.secret:/run/secrets/root:ro"
       ]
     },
     {
@@ -96,14 +95,14 @@
       "network": "mongodb",
       "volumes": [
         "/var/lib/mesh/mongodb/broker:/run/secrets/broker:ro",
-        "/var/lib/mongodb/grants:/var/lib/mongodb/grants:ro",
-        "/var/lib/mongodb/root.secret:/run/secrets/root:ro"
+        "${dir:grants}:${dir:grants}:ro",
+        "${dir:state}/root.secret:/run/secrets/root:ro"
       ],
       "env": {
         "MESH_PROVISION_MONGODB": "mongodb://root@mongodb-server:27017/admin?authSource=admin",
         "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/root",
         "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_RECEIVES": "/var/lib/mongodb/grants/mesh.json"
+        "MESH_RECEIVES": "${dir:grants}/mesh.json"
       },
       "artifact": "runtime"
     }